Sophos warns of Harry Potter USB Worm

Permalink: Sophos warns of Harry Potter USB Worm

Web security firm, Sophos, has identified a new Harry Potter-themed worm.

The worm is disguised as a file containing a copy of Harry Potter and the Deathly Hallows, the final novel in the Harry Potter series which is due to be launched shortly.

The worm, called W32/Hairy-A, claims to reveal the secrets of the latest book.

If a PC is configured to allow a USB drive to ‘auto-run’, the user will see a file called ‘HarryPotter-The Deathly Hallows-doc’ when the USB drive containing the infected file is plugged in.

The corrupted Word document states that ‘Harry Potter is dead’ while the worm locates other removable drives that it could infect.

After infecting Windows computers, the worm creates several new users which have the same name as characters from the Harry Potter books - Hermione Granger, Harry Potter and Ron Weasly.

A message is also displayed saying “Read and repent. The end is near, repent from your evil ways O ye folks, lest you burn in hell … JK Rowling especially.”

Every time an infected user opens the Internet Explorer browser, their start page is redirected to an Amazon.com Web page, selling a spoof copy of the novel called “Harry Putter and the Chamber of Cheesecakes.”

Sophos advises computer users to disable the auto-run facility of Windows in order to prevent infection by the worm.

Computer users should also check removable media, such as USB drives, for malware before use.